Patch Tuesday, April 2025 Edition
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-26663 | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network | 8.1 | 2% | ||
| CVE-2025-26671 | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network | 8.1 | 1% | ||
| CVE-2025-27480 | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network | 8.1 | 12% | ||
| CVE-2025-27482 | Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network | 8.1 | 2% | ||
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) | 7.8 | 19% | KEVRansomwarePoC ×2 | KEV |
From the original article
3 min read at krebsonsecurity.comMicrosoft today released updates to plug at least 121 security holes in its Windows operating systems and software, including one vulnerability that is already being exploited in the wild. Eleven of those flaws earned Microsoft’s most-dire “critical” rating, meaning malware or malcontents could exploit them with little to no interaction from Windows users.
krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.